# interception Published articles for interception. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Harnessing the Power of Service Workers: Building Offline-Ready Web Apps DevFeed: [Harnessing the Power of Service Workers: Building Offline-Ready Web Apps]() Original publisher: [Read original article]() Author: Jitendra Kumar Published: 2024-06-12T06:49:30Z Content type: tutorial Language: en Sources: [Housing.com]() Topics: [Web Development](), [web applications](), [Caching](), [browser](), [interception](), [JavaScript](), [Persistence]() Tags: [browser](), [building](), [cache](), [caching](), [interception](), [javascript](), [offline](), [persistence](), [web](), [web-apps]() ### AI overview This tutorial explains how service workers run in the background of web applications, act as proxies between pages and the network, and enable offline functionality by serving cached content. It compares service worker caching with standard browser caching and describes Cache Storage as distinct from Local Storage and Session Storage. ### Source excerpt In the dynamic world of web development, where user experience reigns supreme, having a web application that functions seamlessly even in offline mode is no longer a luxury but a necessity. Enter service workers -- the unsung heroes behind the scenes, making this magic possible. In this blog post, we'll delve into the world of service workers, exploring what they are, how they work, and how you can harness their power to supercharge your web applications. What is a service worker ? At its core, a service worker is a script that runs in the background of a web application, separate from the main JavaScript thread. It acts as a proxy between your web page and the network, enabling a host of powerful features such as offline functionality. This means that even if the user loses internet connection, the service worker can still serve cached content, providing a seamless offline experience. How service worker caching is different than standard browser caching ? Location and Scope: Service Worker: JavaScript files running in the background, separate from the main browser thread. Browser Caching: Resources stored within the browser itself, part of the main browsing environment. 2. Control Over Network Requests: Service Worker: Provides fine-grained control over network requests, allowing interception and customized handling. Browser Caching: More passive, resources are stored and retrieved by the browser without direct developer intervention. 3. Offline Functionality: Service Worker: Enables creation of offline experiences by caching and serving resources even when offline. Browser Caching: Improves performance but doesn't inherently provide offline functionality. 4. Persistence and Management: Service Worker: Persistent and programmatically managed caches, controlled by developers. Browser Caching: Managed by the browser, with limited developer control over cache lifecycle. Where service worker data is stored ? Service worker caching is stored in a separate storage called ## New ways to inject system CA certificates in Android 14 DevFeed: [New ways to inject system CA certificates in Android 14]() Original publisher: [Read original article]() Author: HTTP Toolkit; Tim Perry Published: 2023-09-21T12:00:00Z Content type: tutorial Language: en Sources: [HTTP Toolkit]() Topics: [Android](), [HTTP](), [Emulator]() Tags: [adb](), [android](), [article](), [certificates](), [interception](), [tls]() ### AI overview This article explains that Android 14 blocks the previous direct method of installing system-level CA certificates, including on rooted devices, but describes newer practical approaches for rooted Android 14+ devices. It also distinguishes system-level certificate injection from enterprise-managed and user-installed certificates, and mentions HTTP Toolkit's ADB-based automatic setup. ### Source excerpt A couple of weeks ago I published a post about changes in Android 14 that fundamentally break existing approaches to installing system-level CA certificates, even with root access. This has triggered some fascinating discussion! I highly recommend a skim through the debate on Mastodon and Hacker News. Since that was posted, quite a few people have talked to me about possible solutions, going beyond the previous approaches with new mechanisms that make it practical to do this in Android 14+, and there are some good options here. While direct root access to change these certificates by simply writing to a directory is indeed no longer possible, root is root, and so with a bit of work there are still some practical & effective ways to dig down into the internals of Android and seize control of these certs once more. Choose your own adventure: If you just want to intercept an Android 14+ device right now, stop reading this, download the latest HTTP Toolkit, connect your device to ADB, click the 'Android Device via ADB' interception option for automatic setup, and dive into your traffic. If you just want to know the steps to manually do system certificate injection on Android 14 for yourself, jump down to How to install system CA certificates in Android 14. If you want the full background, so you can understand how & why this all works, read on: Clearing up confusion Before digging into this, I do want to explicitly clear up a few misunderstandings that I've seen repeatedly pop up from the previous article: These changes don't affect installation of CAs in other scenarios. As far as I'm aware, CA installation for fully managed enterprise-provisioned devices and the limited user-installed (as opposed to system-level) CA certificates will continue functioning as before. If you're not using root access to inject system-level CA certificates into a rooted device or emulator, you don't need to worry about this. Similarly, it is still possible to soft-remove system CA certific ## Android 14 blocks modification of system certificates, even as root DevFeed: [Android 14 blocks modification of system certificates, even as root]() Original publisher: [Read original article]() Author: HTTP Toolkit; Tim Perry Published: 2023-09-05T14:00:00Z Content type: article Language: en Sources: [HTTP Toolkit]() Topics: [Android](), [Security](), [TLS (Transport Layer Security)](), [API]() Tags: [android](), [android-14](), [api](), [certificates](), [interception](), [root](), [security](), [tls]() ### AI overview The article examines Android 14's tighter restrictions on modifying trusted certificate authorities, including on rooted devices, and the resulting challenges for developers, testers, and researchers. An update notes that multiple workarounds now allow certificate injection. ### Source excerpt Update: This post sparked a lot of excellent discussion and debate on workarounds, and there are now multiple working solutions to allow certificate injection on Android 14, despite the restrictions discussed here. See the update post for more details. When Android was initially announced in 2007 by the Open Handset Alliance (headed by Google) their flagship project was billed as an "open platform", "providing developers a new level of openness", and giving them "complete access to handset capabilities and tools". We've come a long way since then, steadily retreating from openness & user control of devices, and shifting towards a far more locked-down vendor-controlled world. The next step of Android's evolution is Android 14 (API v34, codename Upside-Down Cake) and it takes more steps down that path. In this new release, the restrictions around certificate authority (CA) certificates become significantly tighter, and appear to make it impossible to modify the set of trusted certificates at all, even on fully rooted devices. If you're an Android developer, tester, reverse engineer, or anybody else interested in directly controlling who your device trusts, this is going to create some new challenges. Before we get into the finer details, first I want to talk a little about the context around Android CA management and how we got here, but if you want to jump to the latest details you can go straight to the Enter Android 14 section below. "Open Software, Open Device, Open Ecosystem" While the initial principles of Android were very much focused on open software, controllable by users and developers, over more recent years Android has increasingly limited the control of users, developers & researchers over their own devices. The key turning point in this process was Android 7 (Nougat, released in 2016) in which the certificate authorities (CAs) on the device that were previously fully modifiable by the owner of the phone were split in two: one fixed list of CAs provided ## Next.js 13.3 DevFeed: [Next.js 13.3]() Original publisher: [Read original article]() Author: Tim Neutkens Published: 2023-04-06T18:00:00Z Content type: release Language: en Sources: [Next.js Blog]() Topics: [Next.js](), [Open Graph protocol](), [Routing (disambiguation)](), [Search engine optimization (SEO)](), [Single-page application (SPA)](), [Caching]() Tags: [caching](), [images](), [interception](), [next-js](), [performance](), [release](), [routing](), [seo]() ### AI overview Next.js 13.3 introduces community-requested features including a file-based Metadata API, dynamic Open Graph image generation, static export support for the App Router, and parallel routes with interception. The release also advances App Router toward stability while focusing on performance improvements, behavioral refinements, and bug fixes. ### Source excerpt Next.js 13.3 introduces dynamic open graph images, advanced static exports, parallel routes and interception, OTEL support, and more. ## EU Funding for Mobile App Traffic Interception DevFeed: [EU Funding for Mobile App Traffic Interception]() Original publisher: [Read original article]() Author: HTTP Toolkit; Tim Perry Published: 2023-02-27T12:00:00Z Content type: article Language: en Sources: [HTTP Toolkit]() Topics: [interception](), [Mobile](), [Security & Privacy](), [Android](), [iOS](), [Instrumentation](), [Open Source](), [Network]() Tags: [android](), [announcements](), [certificates](), [development](), [eu](), [frida](), [funding](), [hooks](), [http](), [instrumentation](), [interception](), [ios](), [mobile](), [mobile-apps](), [network](), [open](), [privacy](), [product-development](), [security](), [technical]() ### AI overview HTTP Toolkit announces EU-backed funding to improve HTTPS traffic interception for mobile apps on iOS and Android. The project will use Frida integrations and hooks to support app-specific interception, automatic certificate unpinning, and simpler setup. ### Source excerpt HTTP Toolkit has been selected to receive another round of open-source funding from the EU! This aims to improve interception of HTTPS traffic from mobile apps, making it easier for both security/privacy researchers and normal technical users to inspect & manipulate the data that any app they use sends & receives. This funding will directly support work to improve the precision & usability of mobile app interception, on both iOS and Android. In a couple of clicks, you'll be able to target any app installed on a connected device (on either platform) and inspect all its traffic. That means no background noise from full system interception, automatic certificate unpinning, and no fiddly manual setup required. HTTP Toolkit can already automatically intercept Android devices, but only globally for the whole device (using Android's VPN APIs), with system certificates injected but without certificate unpinning, and with no automatic setup support for iOS at all. All those caveats are going away (of course, I'm intending the existing device-wide interception to remain a fully supported option indefinitely too). This is going be powered by a set of new integrations & hooks for Frida, a popular open-source instrumentation toolkit. Many advanced HTTP Toolkit users are already using Frida independently (see the Frida certificate unpinning guide for more info) but doing so often requires quite a bit of setup and specialist knowledge. This project is going to take that away, making network interception of mobile apps easily accessible to anybody who knows what "HTTP" is. All this is being funded by the fantastic NLNet Foundation as part of NGI Zero Entrust, a program funding open-source EU projects that support transparency around data use & privacy in modern technology. This is part of the EU's Next Generation Internet (NGI) initiative, aiming to directly fund researchers & open-source developers to encourage the future engineering of the Internet towards European values: "openn ## Debugging WebRTC, IPFS & Ethereum with HTTP Toolkit DevFeed: [Debugging WebRTC, IPFS & Ethereum with HTTP Toolkit]() Original publisher: [Read original article]() Author: HTTP Toolkit; Tim Perry Published: 2022-10-28T13:30:00Z Content type: article Language: en Sources: [HTTP Toolkit]() Topics: [WebRTC](), [Ethereum](), [IPFS](), [debug](), [web applications](), [browsers](), [HTTP]() Tags: [blockchain](), [browsers](), [debug](), [debugging](), [decentralized-web](), [ethereum](), [http](), [interception](), [javascript](), [web](), [webrtc]() ### AI overview This article describes HTTP Toolkit support for capturing, debugging, mocking, rewriting, and injecting errors in WebRTC, IPFS, and Ethereum traffic used by decentralized web applications. It also explains why debugging multi-protocol applications matters and discusses related protocols used alongside HTTP. ### Source excerpt HTTP is important on the web, but as other alternative protocols grow popular in networked applications, it's often important to be able to capture, debug and mock those too. I've been working on expanding HTTP Toolkit's support for this over the past year (as one part of a project funded by EU Horizon's Next Generation Internet initiative), to extend HTTP Toolkit to cover three additional rising protocols that are often used alongside simple HTTP in decentralized web applications: WebRTC, IPFS & Ethereum. This is now live! If you're using HTTP Toolkit to intercept browsers, and a web application connects to another peer over WebRTC, interacts with the Ethereum blockchain, or pulls content from the IPFS network, then you'll now see this inline amongst your collected HTTP traffic, and you can create rules to rewrite these requests, define mock responses, or inject errors. Let's talk about why this matters, what you can do with this, and how it actually works internally: Why? HTTP remains the key protocol on the web, by a wide margin, and that's not going to change any time soon. That said, there are an increasing number of new protocols being explored both alongside and on top of HTTP, covering alternate use cases and supporting different communication models, and as software evolves this will only increase. HTTP Toolkit needs to be able to support these, to ensure that you can easily understand and test all communications from the increasing number of multi-protocol applications. There's a lot of examples of HTTP-adjacent protocols where this applies: WebSockets, which grew to cover use cases needing persistent connections that weren't well supported by the request/response model, which use HTTP just for initial connection setup, and are now widely supported and used in HTTP-based apps. WebTransport, a new QUIC-based connection protocol that's aiming to supplant WebSockets with a modern approach that adds a swathe of other benefits on top. GraphQL, a general-purpose ## How to intercept, observe & mock WebRTC traffic DevFeed: [How to intercept, observe & mock WebRTC traffic]() Original publisher: [Read original article]() Author: HTTP Toolkit; Tim Perry Published: 2022-10-13T10:00:00Z Content type: tutorial Language: en Sources: [HTTP Toolkit]() Topics: [WebRTC](), [Tooling](), [P2P](), [Security & Privacy]() Tags: [debugging](), [developer-tools](), [how-to](), [interception](), [javascript](), [p2p](), [security-privacy](), [webrtc]() ### AI overview This tutorial explains why WebRTC traffic is difficult to inspect and mock, covering its peer-to-peer encryption, negotiated networking, and limited debugging APIs. It introduces MockRTC and describes how controlling one peer can enable interception, observation, and transformation of WebRTC traffic. ### Source excerpt WebRTC allows two users on the web to communicate directly, sending real-time streams of video, audio & data peer-to-peer, from within a browser environment. It's exciting tech that's rapidly maturing, already forming the backbone of a huge range of video chat, screen sharing and live collaboration tools, but also as a key technology for decentralization of web apps - providing a P2P data transport layer used by everything from WebTorrent to IPFS to Yjs. Unfortunately though, it doesn't have the tooling ecosystem that developers used to networking with HTTP often expect. There's few supporting tools or libraries, inspecting raw traffic is hard or impossible, and mocking WebRTC traffic for automated testing is even harder. Even built-in low-level browser tools like chrome://webrtc-internals don't allow seeing messages sent on WebRTC data channels. It's hard to build modern secure web applications on top of protocols that you can't directly see or interact with. This doesn't just affect developers: it also seriously impacts security & privacy researchers and reverse engineers, each trying to investigate the traffic sent & received by the apps we all use. If you want to know what data a webapp you use is sending over WebRTC, right now it's very hard to find out. Intercepting WebRTC traffic to build these tools and libraries is difficult, because unlike protocols like HTTP that were designed to allow active proxying and user-configureable PKI (i.e. CA certificates) early on, WebRTC encrypts all traffic using peer-to-peer negotiated certificates for authentication without PKI, communicates in a wide variety of different negotiated ways at the network level to avoid NAT issues, and offers no convenient APIs to configure this for debugging. All of this provides some great features to the protocol as a user, but some serious challenges when building developer tools. As it turns out though, despite this, there are just enough places where we can hook into that it is possible ## On my resignation as regulator of the Dutch intelligence and security services DevFeed: [On my resignation as regulator of the Dutch intelligence and security services]() Original publisher: [Read original article]() Published: 2022-09-09T08:55:00Z Content type: opinion Language: en Sources: [Bert Hubert's writings]() Topics: [Security](), [like](), [interception](), [Hacking]() Tags: [authorization](), [hacking](), [intelligence](), [interception](), [national-security](), [security](), [technical]() ### AI overview A former member of the Dutch intelligence and security services oversight board explains his resignation. He says proposed changes would largely eliminate his technical risk-analysis role, reduce regulatory requirements for bulk interception, permit algorithmic analysis of bulk-intercepted data without external approval, and shift parts of oversight from prior authorization to ongoing or retrospective review. ### Source excerpt I've seen some mediocre automated translations of my Dutch language resignation statement go round. To prevent any confusion, please find the story here in English: Until today I was one of the three members of the board that checks warrants for the Dutch intelligence and security services. This board is called "Toetsingscommissie Inzet Bevoegdheden" or TIB. If either of the civil or the military intelligence and security services of The Netherlands want to use their lawful intercept, SIGINT or hacking (& some other) legal powers, they have to first convince their own jurists, then their ministry and finally the TIB. ## Chrome 99 expands Certificate Transparency on Android, affecting HTTPS interception and debugging tools DevFeed: [Chrome 99 expands Certificate Transparency on Android, affecting HTTPS interception and debugging tools]() Original publisher: [Read original article]() Author: HTTP Toolkit; Tim Perry Published: 2022-05-11T16:00:00Z Content type: tutorial Language: en Sources: [HTTP Toolkit]() Topics: [Certificate Transparency](), [Chrome](), [Android](), [Security](), [Tooling]() Tags: [android](), [browsers](), [certificate-transparency](), [chrome](), [developer-tools](), [interception](), [security](), [tls]() ### AI overview This article explains how Chrome 99's expansion of Certificate Transparency to all Android Chrome users affects HTTPS interception with trusted system CA certificates, including developer debugging tools. It describes why Certificate Transparency exists and discusses workarounds for debugging Chrome traffic on Android. ### Source excerpt Certificate transparency is superb improvement to HTTPS certificate security on the web that's great for users and businesses, but on Android it creates a huge problem for the many developer tools like HTTP Toolkit which install trusted system certificates into Android to intercept & debug app traffic. This doesn't appear in the main announcements anywhere, but buried deep in the enterprise release notes for Chrome v99 there's a small note that says: Certificate transparency is already enforced on desktop platforms, and for some Android users. Chrome 99 expands certificate transparency to all Android Chrome users. And with that small note, Chrome on Android become uninterceptable for all HTTP Toolkit users using rooted devices, and anybody else who actively installs and trusts their own system CA certificates. If you're running into an ERR_CERTIFICATE_TRANSPARENCY_REQUIRED error in Chrome while trying to debug your HTTPS traffic with some MitM debugging proxy, then this is affecting you too. Let's talk about how certificate transparency works, why this breaks, and how you can work around it to keep debugging HTTPS from Chrome on your Android device regardless. Certificate Transparency (CT) HTTPS certificates are issued and signed by Certificate Authorities (CAs) who are trusted by your browser & OS. That's great when it works, but sometimes it doesn't. CAs can make mistakes when issuing certificates, when verifying a client's identity beforehand, or through malice somewhere, and issue fraudulent certificates to people who shouldn't have them. For example, let's say a trusted CA issues a certificate for google.com to the wrong person (this actually happened, repeatedly). That issued certificate is incredibly powerful - whoever has it can freely intercept all traffic sent by anybody to Google.com and both see & modify that traffic, whilst browsers will show all users a padlock and tell them everything is totally fine & secure. Even worse though: attacks like this were ## Fighting TLS fingerprinting with Node.js DevFeed: [Fighting TLS fingerprinting with Node.js]() Original publisher: [Read original article]() Author: HTTP Toolkit; Tim Perry Published: 2021-12-07T13:40:00Z Content type: tutorial Language: en Sources: [HTTP Toolkit]() Topics: [TLS (Transport Layer Security)](), [Node.js](), [Web Scraping](), [HTTP]() Tags: [browser](), [http](), [interception](), [javascript](), [mitm](), [node-js](), [proxy](), [tls]() ### AI overview This tutorial explains how TLS fingerprinting lets servers and proxies identify client software from unencrypted connection metadata. It examines how this can block HTTP Toolkit and other automated traffic, then shows how Node.js techniques can work around that blocking. ### Source excerpt The modern internet is full of services that want to know who you are. Fingerprinting is the latest way to do this: capturing many small details about your client, and using it to create an id that's sufficiently unique to recognize you and infer details about your network client and device. This is a privacy problem, which I'm not going to focus on here, but collecting and analysing interaction metadata is also a powerful tool to recognize certain types of clients, even when they attempt to disguise themselves. TLS provides a particularly good surface for this kind of fingerprinting, which allows a server or proxy to recognize the kind of software (a specific browser version, Python, Ruby, Node.js, etc) that's opening any TLS connection, before the client has even sent any data (such as an HTTP request) within the connection, and purely using unencrypted public data from the connection. In many cases, this is a problem. HTTP Toolkit acts as a MitM proxy for HTTP(S) traffic inspection & mocking, and this potentially allows servers to recognize and block it, along with any other similar debugging proxies. Many other automated scripts and tools can also be recognized, blocking web scraping and other requests from anything but a real browser. Until recently, I thought this was fairly theoretical, but last week an HTTP Toolkit user showed me a real-world example, where non-browser traffic is blocked completely, based just on its TLS fingerprint, causing big problems for HTTP Toolkit usage. Fortunately, we can work around this. In this article, I want to explain how TLS fingerprinting works, look at a real-world example, and then see exactly how you can defeat this blocking using Node.js (with techniques that you can easily apply elsewhere too). How does TLS fingerprinting work? TLS provides a huge amount of data for fingerprinting. Every connection secured by TLS (for example, all HTTPS requests) starts with a 'client hello' message from the client, sent unencrypted, wi ## Reverse engineering & modifying Android apps with JADX & Frida DevFeed: [Reverse engineering & modifying Android apps with JADX & Frida]() Original publisher: [Read original article]() Author: HTTP Toolkit; Tim Perry Published: 2021-11-22T12:30:00Z Content type: tutorial Language: en Sources: [HTTP Toolkit]() Topics: [Reverse Engineering](), [Android](), [Security](), [App]() Tags: [android](), [certificates](), [frida](), [http](), [interception](), [jadx](), [reverse-engineering](), [security]() ### AI overview A practical guide to reverse engineering and modifying Android applications using JADX and Frida. It introduces the initial workflow for locating and understanding relevant code, using certificate pinning as an example for disabling runtime checks so HTTP Toolkit can intercept HTTPS traffic. ### Source excerpt I get a lot of emails from users who want to know exactly what their favourite Android app is doing, and want to tweak and change how that works for themselves. There are some great tools to do this, including JADX & Frida, but using these is complicated, and every reverse engineering problem has its own unique challenges & solutions. There's few good guides to getting started, and even fewer guides on the advanced tricks available. In this article, I want to talk you through the core initial steps to look inside any Android app, give you the tools to find & understand the specific code that matters to you, and then show you how you can use that information to modify the app for yourself. Let's set the scene first. Context I'm assuming here that somebody else has written an Android app that you're interested in. You want to know exactly how a specific bit of behaviour works, and you want to change what it's doing. I'm going to focus on the classic HTTP Toolkit user example here of certificate pinning: where security-conscious apps that send HTTPS traffic go beyond the normal HTTPS validation requirements, and actively check that the HTTPS certificates used are from a small set of specific trusted certificates, not just the standard set trusted by all Android devices. (I'm focusing on certificate pinning because it's a common use case and it's convenient, but the techniques here work for all other kinds of reverse engineering & patching too, don't worry!) Certificate pinning is a problem for HTTP Toolkit users, who are trying to intercept HTTPS traffic to see what messages their Android apps are sending & receiving. It's not possible to intercept these app's traffic because they won't trust HTTP Toolkit's certificate, even after it's been injected into the device's system certificate store. Using the tools we're going to talk about in a moment we can take an unknown 3rd party app, find the certificate pinning code within it, and disable that remotely while the app ru ## EU Funding for Dev Tools for the Decentralized Web DevFeed: [EU Funding for Dev Tools for the Decentralized Web]() Original publisher: [Read original article]() Author: HTTP Toolkit; Tim Perry Published: 2021-09-15T12:00:00Z Content type: article Language: en Sources: [HTTP Toolkit]() Topics: [dev-tools](), [ZeroNet](), [IPFS](), [WebRTC](), [Ethereum](), [interception](), [debug](), [Testing](), [Logging](), [Script]() Tags: [announcements](), [applications](), [decentralized-web](), [dev-tools](), [development](), [ethereum](), [funding](), [interception](), [logging](), [open-source](), [webrtc]() ### AI overview HTTP Toolkit received EU Horizon funding through the Next Generation Internet initiative to expand its interception, debugging, and testing capabilities for decentralized-web applications. The project will focus on IPFS, WebRTC, and Ethereum, with results released under free and open-source licenses. ### Source excerpt Through the Next Generation Internet (NGI) initiative, HTTP Toolkit has been selected for funding from the EU's Horizon research & innovation program, to expand beyond HTTP and offer the same interception, debugging & testing functionality for applications built on top of the decentralized web. This is going to be a huge opportunity to invest in expanding HTTP Toolkit to support some very exciting new technologies, and extending existing core functionality to do so along the way. For this project I'm going to be specifically focusing on 3 main protocols that today form the backbone of the decentralized web: IPFS, WebRTC & Ethereum. For each of these protocols, the essential technologies are usable now, but the wider ecosystem and uptake is still in their infancy. I think it's clear that most mainstream web developers are not currently using these technologies to build production-grade decentralized applications. There are many reasons for this, but one is a lack of high-quality developer tooling. Moving from traditional client/server architectures to building decentralized applications requires developers to replace many day-to-day debugging & testing tools with manual logging, custom scripts and guesswork. This tooling gap makes decentralized development significantly more difficult. The goal here is to fix that, by providing modern tools for the future of the web. This is funded as part of the NGI Pointer project, funding me as an individual to work on this for a year, with all the resulting output to be available under free & open-source licenses (of course, HTTP Toolkit is conveniently already 100% open-source, so that's no change at all). If you're interested in the future of the web and you think developer tooling matters, I hope this is very exciting! If you're an existing HTTP Toolkit user though and you're only interested in HTTP, don't worry. This is equity-free R&D funding, so HTTP Toolkit remains a completely independent open-source project, and although ## Defeating Android Certificate Pinning with Frida DevFeed: [Defeating Android Certificate Pinning with Frida]() Original publisher: [Read original article]() Author: HTTP Toolkit; Tim Perry Published: 2021-07-06T13:30:00Z Content type: tutorial Language: en Sources: [HTTP Toolkit]() Topics: [Android](), [interception](), [SSL](), [debug](), [Security]() Tags: [android](), [certificates](), [debugging](), [frida](), [http](), [interception](), [security](), [security-research](), [tls]() ### AI overview This tutorial explains Android certificate pinning, why it prevents HTTPS interception, and how Frida can be used to remove SSL pinning so researchers, developers, and privacy advocates can inspect an app's traffic. ### Source excerpt Some Android apps go to astounding lengths to ensure that even the owner of a device can never see the content of the app's HTTPS requests. This is problematic for security research, privacy analysis and debugging, and for control over your own device in general. It's not a purely theoretical problem either - protections like this attempt to directly block HTTPS inspection tools like HTTP Toolkit, which allow you to automatically intercept HTTPS from Android devices for inspection, testing & mocking, like so: This depends on the target application(s) trusting the debugging proxy's certificate for HTTPS traffic. These HTTP interception and mocking techniques are super useful for testing and understanding most apps, but they have issues with the small set of hyper-vigilant apps that add extra protections aiming to lock down their HTTPS traffic and block this kind of inspection. In the end, this is your Android device, and whether you're a security researcher checking for vulnerabilities, a developer trying to understand how an app uses its API, or a privacy advocate documenting what data an app is sharing, you should be able to see the messages that the apps you use transmit and receive on your own phone. Protections like certificate pinning make this difficult. Let's talk about how you can fight back, by using Frida to remove SSL pinning, and expose the real traffic that any app is sending. What's certificate pinning? By default, when an Android app makes an HTTPS connection, it makes sure that it's talking to a trusted server by comparing the issuer of the server's certificate to Android's built-in list of trusted system certificate authorities. 99% of apps stick with that default. You can't change the system certificate authorities on normal devices, so this list is fairly reliable and secure. You can change it though on rooted devices and most emulators, so it's quite possible to intercept and inspect HTTPS traffic from these apps by using a debugging proxy for HT ## How HTTP Toolkit handles HTTP and HTTPS traffic on a single port DevFeed: [How HTTP Toolkit handles HTTP and HTTPS traffic on a single port]() Original publisher: [Read original article]() Author: HTTP Toolkit; Tim Perry Published: 2021-04-15T16:45:00Z Content type: article Language: en Sources: [HTTP Toolkit]() Topics: [HTTP](), [interception](), [Protocol (disambiguation)](), [servers](), [Tooling]() Tags: [http](), [interception](), [protocol](), [proxy](), [request](), [responses](), [tls]() ### AI overview HTTP Toolkit uses one incoming TCP port to accept multiple HTTP and HTTPS formats, including HTTP/1.x, HTTP/2, and TLS connections. It combines direct requests, explicit proxying, redirection, and tunneling so traffic can be intercepted and handled by configured rules. ### Source excerpt Traditionally, a TCP port has a single server listening for incoming connections, and that server expects you to send messages in the right protocol for that port. For HTTP, it's normally a web server that'll send you a response directly, or some kind of proxy that will pass all requests through to another server, and then pass the responses back. This is boring. What if you could accept everything, from proxied HTTPS to plain-text HTTP/1.0, all on a single port? HTTP Toolkit acts as an HTTP(S) proxy for debugging and interception. With all the possible combinations of clients and configurations, tools like this can be complicated to set up, and getting everything working and properly intercepted is a common pain point. To make setup as easy as possible, HTTP Toolkit uses a single incoming port for absolutely everything, for every widespread HTTP format, for both HTTP & HTTPS, for both direct and proxied requests. Specifically, on one single port it accepts: Plain HTTP/1.* (1.1, or 1.0 if you just can't quit the 90s) HTTP/1.* over TLS (HTTPS) Plain-text HTTP/2 with prior knowledge Plain-text HTTP/2, upgraded on the first request by an Upgrade header HTTP/2 over TLS (HTTPS) negotiated via ALPN These can then all be combined to suit your tastes with a selection of ways to make your actual HTTP request: Make a direct request to HTTP Toolkit's URL as if it were a server, and mock a response for that in the app (GET /). Proxy through HTTP Toolkit explicitly in plain text (GET http://example.com/). Redirect unsuspecting traffic that's not aware of the proxy to HTTP Toolkit, to transparently proxy traffic elsewhere: GET / Host: example.com Tunnel traffic by connecting with HTTP/1.1, sending CONNECT example.com:443 to make the connection into a tunnel to another server, and then doing any of the above within that tunnel. Tunnel traffic within a single HTTP/2 stream, by sending a CONNECT request to convert that one stream into a tunnel, and then doing any of the above again ## Intercept and edit HTTP traffic from (almost) any Android app DevFeed: [Intercept and edit HTTP traffic from (almost) any Android app]() Original publisher: [Read original article]() Author: HTTP Toolkit; Tim Perry Published: 2021-03-24T17:00:00Z Content type: tutorial Language: en Sources: [HTTP Toolkit]() Topics: [LineageOS](), [HTTP](), [Emulator](), [Android Studio](), [SDK](), [APK](), [debugging](), [dev-tools]() Tags: [android](), [android-studio](), [apk](), [debug](), [emulator](), [how-to](), [http](), [interception](), [sdk]() ### AI overview A step-by-step guide to intercepting and editing HTTP traffic from Android apps using a normal Android emulator, Android Studio, APK installation, and HTTP Toolkit. It explains why HTTPS traffic is difficult to inspect and describes emulator configuration requirements. ### Source excerpt HTTP is used by almost all Android apps to request data, load content, and send changes to backend servers. If you can see and edit these requests & responses then you can understand, debug, and change how any app works, but Android makes this hard to do. By default, almost all apps will use HTTPS but won't trust user-installed certificates. This means that you can't see their traffic with simple proxy tools, and you can't manually trust HTTPS debugging proxies without either editing and rebuilding the entire app, or setting up your own rooted device. Fortunately, there's a quick & easy way around this: you can manually install official APKs into a normal Android emulator, which provides enough access that tools like HTTP Toolkit can capture all traffic for most apps for you totally automatically, and allow you to edit responses in just a couple of clicks. Let's walk through how to do that, step-by-step: Setting up the emulator To get started, you'll need an emulator. It is possible to create and start one using the Android SDK directly (see this article) but it's easiest to just install Android Studio, create an empty project, and use the developer tools provided there (if you're not familiar with these developer tools at all, there's an detailed official guide). To create an interceptable Android emulator, you should create an AVD, that: Can be any device model, though things may be smoother with a popular device like a Pixel 4. Uses an image matching your computer's architecture (ARM64 on M1/M2 Macs, x86_64 on most other computers) since the performance will be far better. Uses a relatively recent stable Android version - Android 7 to 13 should be fine. Uses a 'Google APIs' or 'Android Open Source Project' target image. The 'Google Play' target includes extra restrictions and is not easily interceptable. Once you've created your emulator, start it, and then we need to install the target app. Since we don't have Google Play, you can't do that from the normal app s ## How to intercept & debug all Java HTTPS DevFeed: [How to intercept & debug all Java HTTPS]() Original publisher: [Read original article]() Author: HTTP Toolkit; Tim Perry Published: 2021-03-17T18:00:00Z Content type: tutorial Language: en Sources: [HTTP Toolkit]() Topics: [Java](), [debugging](), [HTTP](), [Instrumentation](), [configuration]() Tags: [bytecode](), [debugging](), [how-to](), [http](), [instrumentation](), [interception](), [java](), [ssl](), [tls]() ### AI overview This tutorial explains how to use a Java agent to intercept, inspect, breakpoint, and mock HTTP and HTTPS traffic from JVM processes. It describes redirecting traffic through a proxy, trusting the proxy to decrypt HTTPS, and rewriting bytecode without application code changes or manual configuration. ### Source excerpt Java and the JVM more generally are widely used for services everywhere, but often challenging to debug and manually test, particularly in complicated microservice architectures. HTTP requests and responses are the core of interactions between these services, and with their external APIs, but they're also often invisible and inaccessible. It's hard to examine all outgoing requests, simulate unusual responses & errors in a running system, or mock dependencies during manual testing & prototyping. Over the last couple of weeks, I've built a Java agent which can do this, completely automatically. It can seize control of all HTTP & HTTPS requests in any JVM, either at startup or attaching later, to redirect them to a proxy and trust that proxy to decrypt all HTTPS, allowing MitM of all JVM traffic. Zero code changes or manual configuration required. This means you can pick any JVM process - your own locally running service, Gradle, Intellij, anything you like - and inspect, breakpoint, and mock all of its HTTP(S) requests in 2 seconds flat. In this article, I want to walk you through the details of how this is possible, so you can understand some of the secret powers of the JVM, learn how to transform raw bytecode for yourself, and build on the examples and source code behind this to build your own debugging & instrumentation tools. If you just want to try this out right now, go download HTTP Toolkit. If you want to know how on earth this is possible, and how you can write code that does the same, read on: What's going on here? In some ways, intercepting all HTTP(S) should be easy: the JVM has standard HTTP proxy and SSL context configuration settings (e.g. -Dhttp.proxy and -Djavax.net.ssl.trustStore) so you could try to configure this externally by setting those options at startup. Unfortunately for you, that doesn't work. Most modern libraries ignore these settings by default, opting to provide their own defaults and configuration interfaces. Even when the library does ## Intercepting HTTPS on Android DevFeed: [Intercepting HTTPS on Android]() Original publisher: [Read original article]() Author: HTTP Toolkit; Tim Perry Published: 2020-11-05T16:45:00Z Content type: tutorial Language: en Sources: [HTTP Toolkit]() Topics: [Android](), [TLS (Transport Layer Security)](), [HTTP](), [debug](), [Testing](), [Mocking]() Tags: [android](), [capture](), [certificates](), [debugging](), [http](), [interception](), [mocking](), [testing](), [tls](), [validation]() ### AI overview This tutorial explains how HTTPS clients establish trust through TLS certificate authorities and chains, then discusses intercepting HTTPS traffic from Android devices for inspection, debugging, testing, and mocking without simply disabling certificate validation. ### Source excerpt To intercept, inspect or manipulate HTTPS traffic, you need the HTTPS client to trust you. If you want to intercept your own HTTPS on Android, perhaps to capture & rewrite traffic from your Android device for debugging or testing, how do you do that? This isn't theoretical - HTTP Toolkit does exactly this, automatically intercepting HTTPS from real Android devices, for inspection, testing & mocking. To do so, it has to automatically ensure that it's trusted by HTTPS clients on Android devices, without breaking security on those devices completely (it would be a very bad idea to simply turn off certificate validation, for example). Here's a demo: Let's talk though how HTTPS clients in general manage this kind of trust, see how that works on Android specifically, and then look at how it's possible to get around this and intercept real HTTPS traffic. How HTTPS trust works An HTTPS request is an HTTP request, made over a TLS connection. Everything we're going to talk about here is really about TLS - the HTTP within is just normal GET / requests and 200 OK responses. I'm not going to go into the lowest level details, but it is important to understand the basics of how TLS works. If you are interested in the fine details of TLS, The Illustrated TLS Connection is well worth a look, for a byte-by-byte breakdown of the whole process. The high-level summary is this: Every TLS client keeps track of some set of root certificate authorities (root CAs) that it trusts completely. When any modern TLS client first connects to a server, its initial message includes a Server Name Indication (SNI), telling the server which hostname it's looking for (e.g. example.com). It expects the server's response to include a valid certificate for that hostname. TLS certificates include a reference to the issuer of the certificate, and a signature proving that the issuer verified the certificate. The issuer's certificate in turn will have its own issuer & signature, creating a chain of certificates ## Android 11 tightens restrictions on CA certificates DevFeed: [Android 11 tightens restrictions on CA certificates]() Original publisher: [Read original article]() Author: HTTP Toolkit; Tim Perry Published: 2020-09-10T16:30:00Z Content type: article Language: en Sources: [HTTP Toolkit]() Topics: [Android](), [Network](), [Reverse Engineering]() Tags: [android](), [android-testing](), [certificates](), [debugging](), [interception](), [network](), [reverse-engineering](), [tls]() ### AI overview This article explains how Android 11 further restricts the installation of Certificate Authority certificates. Apps, debugging tools, and user actions can no longer prompt installation into the user-managed certificate store; users must use a hidden settings page instead. The change affects legitimate Android testing, debugging, reverse engineering, and enterprise network configuration use cases. ### Source excerpt Your trusted Certificate Authorities (CAs) are the organizations that you trust to guarantee the signatures of your encrypted traffic and content. That's a lot of power, and the list of trusted authorities is dangerous to mess around with. Nonetheless, it's also something that power users might want to configure, for Android testing, for app debugging, for reverse engineering or as part of some enterprise network configurations. Android has tightly restricted this power for a while, but in Android 11 (released this week) it locks down further, making it impossible for any app, debugging tool or user action to prompt to install a CA certificate, even to the untrusted-by-default user-managed certificate store. The only way to install any CA certificate now is by using a button hidden deep in the settings, on a page that apps cannot link to. To be clear, carefully managing the trusted CAs on Android devices is important! Adding a CA should not be easy to do by accident or unknowingly. Protecting users from themselves is absolutely necessary here, and it's a hard problem. That said, there are many legitimate use cases where you want to be able to choose which CAs you trust, and that just got much harder. There's a balance here to manage, and I'm not sure Android has made the right choice. Let's dig into the details: How did Android CA certificate management work until now? Until now, an app could ask a user to trust a CA certificate in the user certificate store (but not the system store), using the KeyChain.createInstallIntent() API method. Similarly, the operating system would offer to trust a CA certificate if one was manually opened on the device from the filesystem. These certificate trust prompts came with a variety of loud warnings & confirmations, and mandated setup of a device pin or other screen lock before you could complete them, if one wasn't already set. It wasn't possible to do accidentally, and it was hard to trick users into accepting these scary prompt ## Inspecting Android HTTP with a fake VPN DevFeed: [Inspecting Android HTTP with a fake VPN]() Original publisher: [Read original article]() Author: HTTP Toolkit; Tim Perry Published: 2020-08-25T12:20:00Z Content type: tutorial Language: en Sources: [HTTP Toolkit]() Topics: [Virtual Private Network](), [Android](), [HTTP](), [Tooling](), [Testing](), [debugging](), [Firewall]() Tags: [android](), [debugging](), [firewall](), [http](), [interception](), [testing](), [tooling](), [vpn]() ### AI overview This tutorial explains how HTTP Toolkit uses Android VPN APIs to create an on-device fake VPN that can inspect and rewrite network traffic from other apps. It describes the VPN tunnel interface, protected sockets, and developer uses including testing, debugging, firewall rules, traffic metrics, and simulated connection failures. By default, the approach does not read encrypted traffic. ### Source excerpt Can you build an Android app that can inspect & rewrite the network traffic from every other app on the device? In turns out that, yes, you can. HTTP Toolkit does exactly this, by building an app on top of the Android VPN APIs that fully simulates a fake VPN connection entirely within the device. Here I want to talk through how that works, look at the code that makes it happen, and show you how you can do the same thing for yourself. To be clear, this is not intended (or very effective) as a attack on the security of traffic from the device. When you actually do this Android provides clear warnings & permission prompts to the user during setup, and requires persistent UI notifications any time this is active. In addition this doesn't give you any way to read the contents of encrypted traffic, by default (in the next post, we'll talk about how HTTP Toolkit can do that). There are some interesting & constructive use cases this opens up though for developer tooling. For example: Inspecting & rewriting mobile traffic for testing & debugging (this is HTTP Toolkit's raison d'être). Building a firewall for Android that blocks outgoing app connections according to your custom rules. Recording metrics on the traffic sent & received by your device. Simulating connection issues by adding delays or randomly injecting packet resets. How do Android VPNs work? The Android developer docs have a VPN guide, which is a good starting point. These VPN APIs allow you to register a service in your app, which when activated is given a file descriptor that backs a network tunnel interface. That tunnel interface is then used by the whole device for all network traffic. In addition, your VPN service is given the power to create protected sockets that don't use this tunnel, so the VPN app can communicate with the network without going through itself. Once this is activated, when an app sends some data, instead of that going out to the network, each IP packet is buffered behind this file descri ## Unblocking Node With Unref() DevFeed: [Unblocking Node With Unref()]() Original publisher: [Read original article]() Author: HTTP Toolkit; Tim Perry Published: 2019-09-11T13:30:00Z Content type: tutorial Language: en Sources: [HTTP Toolkit]() Topics: [Node.js](), [Processes](), [interception](), [HTTP]() Tags: [code](), [errors](), [http](), [interception](), [node-js](), [process](), [timeout]() ### AI overview This tutorial explains how Node.js timers keep the event-loop process alive and how calling unref() allows timers to continue running without preventing the process from exiting when no other work remains. It also discusses why explicit cleanup can still be useful and notes a potential performance cost. ### Source excerpt Node.js runs on an event loop. It holds a queue of tasks to run, and runs them, one by one. New tasks appear on the queue while it runs, added by your code (setTimeout) or outside events (a network connection), and the process simply continues until the queue is empty. That's all great, until it isn't. Occasionally you want to break out of that model. What happens if you want to run a schedule task on a fixed interval indefinitely? Typically, life gets difficult: you need to include & manage an explicit shutdown process for that interval, and if you ever forget to shut it down then the process will keep running forever, with no explanation. Ouch. I hit ran into this whilst working on Mockttp (the HTTP interception & testing library behind HTTP Toolkit). Mockttp needs to keep track of your current local IP addresses, to help detect and warn about request loops. That data can change occasionally, so it needs to poll it on an interval, but it's very annoying to have to remember to carefully shut that process down in addition to everything else. Fortunately, it turns out you can fix this easily! Enter unref: Timeout.Unref() Timer functions like setInterval and setTimeout in Node.js return a Timeout object, representing the ongoing timer. These can be passed to clearInterval or clearTimeout to shutdown the timer entirely, but they also have a little-used unref() method. This does something magical: it keeps running your code, but stops it from keeping the process alive. Like so: // Update my data every 10 seconds const interval = setInterval(() => updateMyData(), 10000); // But don't let that keep the process alive! interval.unref(); // Log a message if the app is still running 10 seconds from now const timeout = setTimeout(() => console.log('Still going'), 10000); // But still shutdown cleanly if it wants to stop before then: timeout.unref(); This functions like a flag you can set on your timers, marking them as tasks that node doesn't need to wait for. They'll run as n ## HTTP Toolkit Pro Adds Context-Rich HTTP Debugging and Automated Performance Analysis DevFeed: [HTTP Toolkit Pro Adds Context-Rich HTTP Debugging and Automated Performance Analysis]() Original publisher: [Read original article]() Author: HTTP Toolkit; Tim Perry Published: 2019-04-24T12:00:00Z Content type: release Language: en Sources: [HTTP Toolkit]() Topics: [HTTP](), [debugging](), [Tooling](), [API](), [Caching](), [OpenAPI Specification](), [Compression](), [Open Source](), [cross-platform]() Tags: [announcements](), [api](), [caching](), [compression](), [cross-platform](), [debugging](), [http](), [interception](), [open-source](), [openapi](), [performance-analysis](), [tools]() ### AI overview This release introduces new HTTP Toolkit Pro features for understanding HTTP traffic. It adds API-aware request analysis using OpenAPI data, inline parameter documentation, validation warnings, and automated performance analysis covering response time, compression, and caching. ### Source excerpt HTTP Toolkit is a suite of open-source & cross-platform tools for developing, debugging & testing anything using HTTP. It lets you intercept HTTP(S) with one click, and explore, examine & understand all your traffic, to spot bugs, fix bugs, and build better software. The free release of the first version (HTTP View) has been available for a little while, and today I've got some new killer features launching as part of HTTP Toolkit Pro, to let you look deep inside your HTTP traffic, with all the context you need to understand everything your application is doing. API integrations for 1400+ APIs Understanding your traffic takes more than just the raw data. Using OpenAPI and the OpenAPI directory, HTTP Toolkit can work out exactly which API every single request is talking to, for APIs from AWS to Stripe to Github, and a whole lot more. With that, there's a lot of cool things we can do. For example: Here we've taken a request to the YouTube API, and immediately worked out what operation it's doing, interpreted the parameters to provide inline documentation, pointed out that one parameter has an invalid value, and spotted another required parameter that's missing. Debugging tools with real context - tools that really understand what you're trying to do - let you take your development skills to a whole new level. Performance analysis, tips & warnings Performance is hard. There's a huge number of ways to tweak & tune the speed of your application with HTTP, a lot of confusing specs (what's the difference between a no-store and no-cache cache-control header?), and not a lot of advice. For most applications though, the two most important things to focus on are compression, and caching. Streaming large responses hugely slows down client applications, and caching lets them avoid request round trips entirely. You can now get automated performance analysis for all HTTP responses, including the response time itself, but also the details of the request & response body compression ## Native Controls DevFeed: [Native Controls]() Original publisher: [Read original article]() Author: Shai Almog Published: 2019-01-28T00:00:00Z Content type: article Language: en Sources: [CodeName One]() Topics: [Library](), [iOS](), [passwords](), [interception]() Tags: [blog](), [interception](), [library](), [native](), [password]() ### AI overview The Codename One cn1-native-controls library wraps native widgets for features that are difficult to support otherwise, including device password managers and an iOS SMS interception text field. ### Source excerpt We supported native widgets within the native interface feature since the first public beta. However, this requires native coding and isn't always trivial. Normally you don't really need to do that. E.g. for text fields we implicitly convert the field to a native field as necessary. However, if you wish to use the password manager of the device this won't work. To solve this Steve introduced a new cn1lib: cn1-native-controls. This library wraps some native widgets and lets us use some features that might be tricky without them. Good use cases for this include the password managers which need a native text widget constantly in that spot. Another use case would be iOS's SMS interception text field that can automatically intercept the next incoming SMS and set it to a special native text field. ## One-click HTTP debugging for any CLI tool DevFeed: [One-click HTTP debugging for any CLI tool]() Original publisher: [Read original article]() Author: HTTP Toolkit; Tim Perry Published: 2019-01-22T14:50:00Z Content type: release Language: en Sources: [HTTP Toolkit]() Topics: [Command-line interface](), [HTTP](), [debugging](), [cURL]() Tags: [cli](), [command-line](), [curl](), [debugging](), [github](), [http](), [interception](), [open-source](), [tool]() ### AI overview HTTP Toolkit introduces one-click terminal interception for HTTP and HTTPS traffic from command-line tools. The feature helps developers inspect requests and responses to debug failing applications, understand tool behavior, and identify data sent to analytics or tracking services. ### Source excerpt Debug HTTP(S) from git, npm, apt-get, or any other CLI tool. The command line is powerful, but can be hard to understand, and extremely hard to debug. Ever run a command, see it fail with a cryptic error, and have no idea why? Better tools can help you understand what's really going on. They can let you see inside the command you're running to understand how it's communicating, see what data it's working with, and debug it in depth. Excitingly I've just shipped one-click terminal interception to do exactly this with HTTP Toolkit, for HTTP and HTTPS, to show you everything your CLI is sending and help you work out what the hell is going on. HTTP Toolkit is free & open-source, so if you want to try this yourself, go download it now and dive right in. How do I try it? Install HTTP Toolkit (if you haven't already). On the Intercept page, click the 'Terminal' button. In the terminal that opens, make some HTTP requests (try curl example.com, sudo apt-get update, git clone https://..., or anything!) Open the View page in HTTP Toolkit, and take a look through the full details of every request sent. What can I do with this? Debug failing applications Let's imagine you're using a CLI tool, and it hates you. For whatever reason, it refuses to do the perfectly reasonable thing you ask for. It exits with some cryptic error, or just fails silently, and you're stuck. Maybe you just downloaded it, or maybe it's your code and you've just forgotten how it works (we've all been there). Internally perhaps this script is talking to an HTTP service somewhere, and failing later on. Unfortunately, you have no idea what it's asking for, what it gets in response, or why the result doesn't work. Most applications aren't designed to be debugged, and can be painfully opaque. If you can intercept all HTTP from the app then you see everything that's being sent, spot the error, and fix the root cause directly. Is your script requesting a file from github and then crashing trying to use it? When yo ## TIP: Activation UI and the Builder Pattern DevFeed: [TIP: Activation UI and the Builder Pattern]() Original publisher: [Read original article]() Author: Shai Almog Published: 2017-10-02T00:00:00Z Content type: tutorial Language: en Sources: [CodeName One]() Topics: [API](), [ui](), [twilio api](), [Android](), [interception](), [SDKs]() Tags: [android](), [api](), [app](), [code](), [interception](), [json](), [rest](), [simulator](), [svg](), [transcoder](), [twilio-api](), [ui](), [ui-ux]() ### AI overview A tutorial on combining Twilio REST SMS calls with Android SMS interception into a single builder-based API for an SMS activation flow. It explains how the builder exposes a customizable UI while hiding implementation details, including country selection and flag assets. ### Source excerpt I wrote two posts about the SMS activation process. In the first I discussed using the Twilio API via REST and in the second I discussed the native interfaces for SMS interception we can use in Android. Now it's time to put this all together and create a single API that's fluid. It should include the full UI process but be flexible enough to let you design your own experience.